Title 44pt sentence case

Affiliations 24pt sentence case

20pt sentence case

© ARM 2016

IoT Device Management Security

Mikko Saarnivala

ARM Tech Symposia India

Senior Director IoT Architecture / ARM

December 7th 2016

© ARM 2016 2

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 3

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 4

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Mobile Device

Management

Device

Management

Bootstrapping

(Security)

Firmware

Update

Remote

Management

Fault

Management

Service provisioning

Key management

Provisioning of access control lists

Update application and system software

Apply bug fixes and add new features

Changes to settings

Trigger actuators

Report errors from devices

Query status of devices

Information

Reporting Notify changes in sensor values

Retrieve configuration settings and device status

Diverse IoT deployments with common needs

© ARM 2016 5

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

LWM2M version1.0 architecture

Figure 1: Entities in the LWM2M Architecture. Figure 2: Protocol Stack

© ARM 2016 6

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Architecture, cont.

Internet of Things designs follow a few, frequently re-used design patterns. For an introduction on the design

patterns see at http://www.internetsociety.org/doc/iot-overview and https://tools.ietf.org/html/rfc7452.

LWM2M

Device

LWM2M

Protocol

LWM2M

Service

RESTful API over

HTTP / HTTPS

In Scope

of the

LWM2M

Technical

Specification Outside the Scope

of the LWM2M

Technical Specification

Device-to-Cloud

Pattern

Back-End Data-Sharing Pattern

Application

Server

© ARM 2016 7

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 8

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

The LWM2M RESTful API

High-level message pattern hiding details

of networking and security protocols

• Information reporting interface

– Publish/subscribe interaction for observing changes

in resources.

• Bootstrap interface

– Configure servers info, credentials & ACLs

• Registration interface

– Informs server about “existence” and supported

functionality (e.g., objects, transport bindings)

• Device management & service enablement interface

– Ability to access object instances and resources

© ARM 2016 9

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Building blocks for LWM2M version 1.0

CoAP DTLS Object Model

© ARM 2016 10

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Object model

Objects/Resources are accessed with simple URIs:

/{Object ID}/{Object Instance}/{Resource ID}

Example:

© ARM 2016 11

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Objects

The LWM2M technical specification itself defines eight objects; the repository contains many more

contributed by IPSO alliance, oneM2M, and from vendors.

Object Name ID Description

LWM2M Security 0 Keying material of a LWM2M Client to access a

LWM2M server.

LWM2M Server 1 Data related to a LWM2M server.

Access Control 2 Information used to check whether a LWM2M

Server has access to object.

Device 3 Device related information, including device

reboot and factory reset function.

Connectivity Monitoring 4 Parameters related to network connectivity.

Firmware 5 Capability to update firmware

Location 6 Device location information

Connectivity Statistics 7 Information like transmit and receive counters

© ARM 2016 12

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Limiting notifications

Publish/subscribe is great but think about bandwidth consumption.

Information reporting interface offers features to limit the amount of reported

information.

Time-based limits with minimum period and maximum period:

Pmin – Minimum time to wait (in seconds) before sending a new notify

Pmax – Maximum time in seconds between two consecutive notify

Threshold-based limits with less than and greater than:

Lt – Low limit measurement notification, like low alarm

Gt – High limit measurement notification, like a high alarm

Limits based on rate of change:

St – Minimum delta change required to notify

© ARM 2016 13

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 14

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Securing LWM2M

IoT devices may exchange sensitive information and need to be protected.

IoT end points need to be authenticated and communication requires

protection.

LWM2M supports three credential types:

Pre-shared secrets,

Raw public keys, and

Certificates

Relies on AES-128 and ECC

DTLS requires a random number generator.

The danger is that there is little (to no) randomness in embedded systems.

Paul Bakker talks about “Entropy Requirements in IoT” on the ARM mbed Youtube channel.

© ARM 2016 15

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Bootstrapping architecture

LWM2M client needs credentials to securely communicate with the LWM2M

server using DTLS. Configuration and access rights might change.

LWM2M client (C)

Where does

this information

come from?

IoT Device

Device

credentials

DTLS LWM2M server

ACLs Config Device

credentials

Specification several deployment choices:

Factory bootstrap

Bootstrap from smartcard

Client initiated bootstrap

Server initiated bootstrap

© ARM 2016 16

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 17

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Outlook

Version 1.0 is being finalized now and work on version 1.1 has been

started.

Envisioned additions:

Support for CoAP over TCP/TLS

Protocol gateway support

Support for additional transports, such as HTTP/2.

Additional security features, such as DTLS IoT profile compliance, TLS 1.3

support, application layer security based on COSE, and new bootstrapping

modes.

Support for low power WANs, such as the 3GPP NB-IoT.

© ARM 2016 18

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

Agenda

Device management and the LWM2M architecture

Gentle introduction to LWM2M

Securing LWM2M and bootstrapping

Outlook

Summary

© ARM 2016 19

Title 40pt sentence case

Bullets 24pt sentence case

Sub-bullets 20pt sentence case

1. LWM2M is a big step in standardization that will simplify secure IoT device

management.

2. It re-uses proven internet security technologies.

3. You can get involved in standardization and contribute code today.

Summary

The trademarks featured in this presentation are registered and/or unregistered trademarks of ARM Limited

(or its subsidiaries) in the EU and/or elsewhere. All rights reserved. All other marks featured may be

trademarks of their respective owners.

Copyright © 2016 ARM Limited

© ARM 2016